mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-16 12:02:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-12420: PCRE stack overflow

Browse source 
It was possible to construct a PCRE expression that exceeded the stack.
resulting in a crash:

With fix:

MariaDB [(none)]> SELECT 1
    -> FROM dual
    -> WHERE ('Alpha,Bravo,Charlie,Delta,Echo,Foxtrot,StrataCentral,Golf,Hotel,India,Juliet,Kilo,Lima,Mike,StrataL3,November,Oscar,StrataL2,Sand,P3,P4SwitchTest,Arsys,Poppa,ExtensionMgr,Arp,Quebec,Romeo,StrataApiV2,PtReyes,Sierra,SandAcl,Arrow,Artools,BridgeTest,Tango,SandT,PAlaska,Namespace,Agent,Qos,PatchPanel,ProjectReport,Ark,Gimp,Agent,SliceAgent,Arnet,Bgp,Ale,Tommy,Central,AsicPktTestLib,Hsc,SandL3,Abuild,Pca9555,Standby,ControllerDut,CalSys,SandLib,Sb820,PointV2,BfnLib,Evpn,BfnSdk,Sflow,ManagementActive,AutoTest,GatedTest,Bgp,Sand,xinetd,BfnAgentLib,bf-utils,Hello,BfnState,Eos,Artest,Qos,Scd,ThermoMgr,Uniform,EosUtils,Eb,FanController,Central,BfnL3,BfnL2,tcp_wrappers,Victor,Environment,Route,Failover,Whiskey,Xray,Gimp,BfnFixed,Strata,SoCal,XApi,Msrp,XpProfile,tcpdump,PatchPanel,ArosTest,FhTest,Arbus,XpAcl,MacConc,XpApi,telnet,QosTest,Alpha2,BfnVlan,Stp,VxlanControllerTest,MplsAgent,Bravo2,Lanz,BfnMbb,Intf,XCtrl,Unicast,SandTunnel,L3Unicast,Ipsec,MplsTest,Rsvp,EthIntf,StageMgr,Sol,MplsUtils,Nat,Ira,P4NamespaceDut,Counters,Charlie2,Aqlc,Mlag,Power,OpenFlow,Lag,RestApi,BfdTest,strongs,Sfa,CEosUtils,Adt746,MaintenanceMode,MlagDut,EosImage,IpEth,MultiProtocol,Launcher,Max3179,Snmp,Acl,IpEthTest,PhyEee,bf-syslibs,tacc,XpL2,p4-ar-switch,p4-bf-switch,LdpTest,BfnPhy,Mirroring,Phy6,Ptp'
    ->
    -> REGEXP '^((?!\b(Strata|StrataApi|StrataApiV2)\b).)*$');
Empty set, 1 warning (0.00 sec)

MariaDB [(none)]> show warnings;
+---------+------+---------------------------------------------------------+
| Level   | Code | Message                                                 |
+---------+------+---------------------------------------------------------+
| Warning | 1139 | Got error 'pcre_exec: Internal error (-21)' from regexp |
+---------+------+---------------------------------------------------------+
This commit is contained in:
Daniel Black 2017-04-08 22:47:56 +10:00 committed by Sergei Golubchik
parent 217b8115c8
commit d672f88ef7
2 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
sql/item_cmpfunc.cc
View file

@ -5237,7 +5237,7 @@ int Regexp_processor_pcre::pcre_exec_with_warn(const pcre *code,
bool Regexp_processor_pcre::exec(const char *str, int length, int offset) bool Regexp_processor_pcre::exec(const char *str, int length, int offset)
{ {
m_pcre_exec_rc= pcre_exec_with_warn(m_pcre, NULL, str, length, offset, 0, m_pcre_exec_rc= pcre_exec_with_warn(m_pcre, &m_pcre_extra, str, length, offset, 0,
m_SubStrVec, m_subpatterns_needed * 3); m_SubStrVec, m_subpatterns_needed * 3);
return false; return false;
} }
@ -5248,7 +5248,7 @@ bool Regexp_processor_pcre::exec(String *str, int offset,
{ {
if (!(str= convert_if_needed(str, &subject_converter))) if (!(str= convert_if_needed(str, &subject_converter)))
return true; return true;
m_pcre_exec_rc= pcre_exec_with_warn(m_pcre, NULL, m_pcre_exec_rc= pcre_exec_with_warn(m_pcre, &m_pcre_extra,
str->c_ptr_safe(), str->length(), str->c_ptr_safe(), str->length(),
offset, 0, offset, 0,
m_SubStrVec, m_subpatterns_needed * 3); m_SubStrVec, m_subpatterns_needed * 3);

6
sql/item_cmpfunc.h
View file

@ -1550,6 +1550,7 @@ public:
class Regexp_processor_pcre class Regexp_processor_pcre
{ {
pcre *m_pcre; pcre *m_pcre;
pcre_extra m_pcre_extra;
bool m_conversion_is_needed; bool m_conversion_is_needed;
bool m_is_const; bool m_is_const;
int m_library_flags; int m_library_flags;
@ -1574,7 +1575,10 @@ public:
m_data_charset(&my_charset_utf8_general_ci), m_data_charset(&my_charset_utf8_general_ci),
m_library_charset(&my_charset_utf8_general_ci), m_library_charset(&my_charset_utf8_general_ci),
m_subpatterns_needed(0) m_subpatterns_needed(0)
{} {
m_pcre_extra.flags= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
m_pcre_extra.match_limit_recursion= 100L;
}
int default_regex_flags(); int default_regex_flags();
void init(CHARSET_INFO *data_charset, int extra_flags, uint nsubpatterns) void init(CHARSET_INFO *data_charset, int extra_flags, uint nsubpatterns)
{ {